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(57) Abstract: An online machine data collection 
and archiving process (15) generates a machine data 
profile (18) of a customer computer (5) accessing a 
transaction form of a merchant web site (3) and links the 
machine data profile (18) and a transaction record (6) 
with customer identifying information using a unique 
transaction identification string. The process preferably 
captures parameters typically communicated as part of 
web accesses, such as an IP address, an HTTP header, 
and cookie information. The process additionally causes 
the customer computer (5) to process self-identification 
routines by processing coding within the merchant 
transaction form, the self-identification routines 
yielding further profile parameters. The process further 
includes a routine for bypassing an intervening proxy 
to the merchant web site (3) to reveal the true IP address 
of die customer computer (5). 
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1 OmJNE MACHINE DATA COLLECTION AND ARCHIVING PROCESS 
2 

3 Cross-Reference to Provisional Application 

4 This application claims benefits fi'om provisional application. Serial No. 

5 60/209,936 filed June 7, 2000 and entitled METHOD FOR COLLECTINGMACHINB 

6 DATA FROM CUSTOMERS ON A COMPtfTERNETWORK, 

7 

8 Background of the Invention 

9 The present invention rektes to identity detection technique 

1 0 particulariy, to a process for collecting and utilising machine-identifying data oif computers 

1 1 and other online appliances used in online interactions and transactions and associating the 

1 2 collected machine data with such online interactions. 

1 3 The internet, or global computer netw^ork, represents a new medium fi>r zmke^mg 

1 4 similar to the way mail ordering and telephone ordering did in the past A downside of 

15 int^et marketing is that it also presents new opportumties for unscrupulous persons to 

1 6 take advantage of the mechanisms of int^et transactions by firaudulent and deceptive 

1 7 practices. Merchants and financial institutions bear the initial costs of firaud. However, 

1 8 consumes ultimately pay the costs in the form of prices and credit rates which must take 

1 9 into account losses firom fi'aud, Intemet purchases typically involve the use of web page 
2 0 forms which are filled in by the customer with identity, address, purchase, shippmg, and 

1 



wo 01/97134 

PCT/USOl/18076 
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1 The IP address of a page requesting computer can give an indication of the specific 

2 country wh^ the conq}ut6r is located. > Further, identification of a page-requesting 

3 computer can also recognize a returning user using the same computer as during a 

4 previous access. For sample, pladng an HTTP (hypertext transfer protocol) "cookie" on 

5 a page-requesting computer can make it possible to identify the con^uter on a later 

6 access. 

7 Because direct interaction with a customer's computer is essential in detect 

8 firaud, it has been assumed that any viable fraud detection software must be integrated witii 

9 a merdiant's software. As a result, most enstingfimtd detection sohitions require 

1 0 merchants to either abandon or extensively modify their existing web-based transaction 

11 proces^g software. An additional problem with focusing ftaud detection at smgle 

1 2 merchants is that perpetrators of ftaud often hit many merchants in an attempt to avoid or 

1 3 delay detection. Thus, an ideal system for fi^ud detection in online marketing would only 

1 4 minimally affect the merchant's existing software and would route fi^aud detection eflEbrts 

1 5 through a central, third-party entity serving a large multitude of merchants. 
16 

17 Summary of the Invention 

1 8 The present invention provides a process for collec6ng data assodated with a 

1 9 customer's computer during access of a merchant, financial, other host web site, and 

2 0 assodating a transaction identification numb^ with the data and with a transaction fi>rm of 

21 the merchant. GeneraUy, the present mvention captures machme identifying data from 
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1 medium, and/or the trae machine characteristics of the accesstag appliance is/are essential 

2 or desirable to the interaction. 

3 The host entity which operates the host system accessed is intended to encompass 

4 a commercial, financial, educational, govOTunental, assodational, or other type of entity. 

5 The term ''merchant" will be used hardn to refer to such a host entity without intent to 

6 limit the present invention to commercial transactions. The medium of access is intended 

7 to be interpreted as including a global computer network such as the internet or world 

8 Tvide wd), as well as other types of networks which may be less than global but which are 

9 publicly and/or anoirymously accessible. The term 'Internet will be used herdn to refer 

10 to the medium through which accesses to the host ratity are made. The terms ''customer 

11 computer^' or "madiine" are used herein to refer to a device for Meeting remote access to 

12 a host system over a digital mecfium and are meant to encompass not only conventional 

1 3 types of personal computers, but also additional types of "digital appliances" with online 

1 4 access capabilities, such as: cdl phones, p^sonal digital asi^ant devices, electronic game 

1 5 systems, television sets with online access capabilities, web appliances for vehicles, and 

1 6 any other type of device with online access capabilities whether connected to a wired 

1 7 communications network directly or by a radiant technology. 

1 8 The machine data collection process of the present invention contemplates a two 

1 9 party process embodiment in which a "merchant" processes and/or stores machme data 
2 0 profiles of customer computers in-house, as well as a three party process embodiment in 
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1 computers accessing the second party or merchant web site is communicated to and storeid 

2 within a third party system^ referred to herein as a machme data archive service. In the 

3 three party process, the transaction ID could be generated by the merchant system, but is 

4 preferably generated by the arcMve service. The use of the tenn "'arcMve" is not meant to 
5 . mdicate that the customer machme data profiles are stored permanently within the thkd 

6 party systenL Permanent storage of such profiles may not be practical, as fir as yieldmg 

7 b^efidal results to the purposes for which the profiles are collected. Thus, the term 

8 ""archive'' is meant to indicate a central storage &dlity, such as a database, with a selected 

9 retention period, with purging of most profiles afier a certam length of time. 

10 In the three party process a routine or line of code is added into the hypert^ 

1 1 markup language (HTML) code which deSnes the merchant's web page, particular^ an 

1 2 order or transaction form page. The added routine issues a request for a machine data 

13 coUection(MDC) script to the third-party web site when the fon^ 

14 by the customer's browsa:. When the script request is received by the machine data 

1 5 archiving service (MDAS), the archive service generates a unique transaction 

1 6 identification (J A/ID) and checks for its own cookie, if no MDAS cookie is present, the 

1 7 archive service sends a cookie to the requesting computer along with a machme data 

1 8 collection (MDC) script having the transaction ID embedd^ therein. The MDC script is 

1 9 executed by the customer's browser, causing collection of certain data firom the 

2 0 customer's compute vMch is sent back to the archive service along with the transaction 

21 ID and stored in a madme data profile in the machine data ardiive. The transaction ID is 
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1 on the String of codes representing the characters. Hie particular conversion process or 

2 hashing fiinction used may be one of maiQr typ^ of conventional conversion algorithms or 

3 hashing functions, which are typically used for data integrity tests. The resulting string 

4 from the MDC conversion process is a so-called fingerprint, which is returned to the 

5 archive service along with the transaction ID for storage in the machine profile. A time 

6 value, queried from the customs* computer tune-of-day dock; is retumed with the 

7 jSngerprint string and stored in conjunction therewith. 

8 An HTTP proxy is one of several types of proxies through which a browser may 

9 be setup to operate. Setting up an HTTP proxy, causes HTTP requests to be rdayed by a 

1 0 primary gateway, through which the computer actually mter&ces to the intemet, to a 

11 remote secondaiy gateway, or pro^gr, with an IP address dififerent from the primaty 

12 gateway IP address. Such redirection hides the true IP address of a computer. The proxy 

1 3 piercing opmdon of the MDC script qu^es the customs compute for any LAN (local 

1 4 area network) address which may be assigned to the computer and reads the system time 

1 5 of day dock. Then attempts are made to send the IAN address, if any, the time value, 

1 6 and the transaction ID to the archive service using a protocol which will not be redirected 

1 7 through the HTTP proxy, for example a lower level protocol such as TCP/IP or UDP 

1 8 protocols. If the attempt is successful, the message contaii^g the time value, the 

1 9 transaction ID, and LAN address arrive at the archive service web site with the true return 

20 BP address of tiie customer compute, whetfier an HTTP proxy intervenes or not The 

21 IAN address and IP address so derived are stored in the machine profile. Itshouldbe 
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1 Brief Description of the Drawings 

2 Fig. 1 is a simplified block diagram illustrating a plurality of customer and 

3 merchant computers interfaced to the intemet along with a machine data archiving service 

4 computer for practidng the machine data collection process of the present inv^tion. 

5 Fig. 2 is a simplified block diagram illustrating connection of a customer computer 

6 to the internet, with optional components shown in phantom lines. 

7 Fig. 3 is a flow diagram illustrating principal steps of the machine data collection 

8 and archiving process according to the present invention. 

9 Fig. 4 is a flow diagram illustrating more detailed steps of the machine data 

1 0 collection and archiving process according to the present invention. 

11 Fig. 5 is a flow diagram illustrating a stiUfiirther detailed steps in the machine data 

1 2 collection and archiving process of llie present tnv^tion. 

1 3 Various objects and advantages of this invention will become apparent Som the 

1 4 following description taken in relation to the accompan^g drawings wh^rdn are set 

1 5 forth, by way of illustration and example, certain embodiments of this invention. 

16 The dravdngs constitute a part of this spedfication, include exemplary 

1 7 embodiments of the present invention, and illustrate various objects and features thereof 
18 

19 
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pgtjUIed Pescrintinn ntfh^ T«y^"tiffn 
As required, detafled embodimeiits of the present invention are disclosed herein; 
however, it is to be understood that the disclosed embodiments are merefy «cemplaiy of 
theinvention,whichmaybeembodiedinvario«sforms. Therefore, specific structural and 
fimctional details disclosed heran are not to be interpreted as limittag, but merely as a 
baasfor the claims and as a rq«esent8tive basis for teaching one skiUed in the art to 
variously employ the present invention in viitualfyany^^^^ 
Referring to the drawings in more detail; 
The reference numeral 1 (Rg. 3) generally designates 
a process for online coHection of machine identifying or profiling data of computers 
involved in commercial transactions and for ardriving such data to fedfitate analyas fer 
fiaud detection purposes. The process collects machine identifyi^g or profiling data of 
con^ iim,ived in commercial transactions and archives such data in a third-party 
machine data arddve service in association with a transaction identification strii« or ID 

wMchisalsowrittenintoatransactionformofamerchantwrthwhomthe^^^ 
conducting a transaction. 

F^g. 1 ilhistrates a phiralily of host entities or merchants with correspondiiig 
merdiant computers 2, on which are operated merchant web sites 3 ^«Aich are accessible 
overaglobal computer netwoiic, such as tiie internet 4, by a pluraUty of customer 
con^utersS. Ihemercd^nt computer. 2 execute various programs wMch enable the 
ofproducts or services by way oftheintemet 4. Hie merchant web sites 3 typicafly make 
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1 use of form type web pages with which the customers 5 interact by filling in various data 

2 fields, for example, name, address, shipping address, telephone numb^, (^edit card type 

3 and number and ejqpiration date, and description and quantities of products to be ordered, 

4 The merchant transaction forms are usually written in hypertext markup language 

5 (HTML) and may include requests for code written in other languages, such as Java and 

6 the like. When a customer 5 accesses a merchant's transaction form, a transaction fyrm 

7 file is communicated to the customer's conq)uter with various data fields displayed as fill- 

8 in boxes or the like. The customer fills in the appropriate fields and selects a submit 

9 "button*' which activates a routine to tnmsfer the coUe^ 

1 0 merchant web site 3 for processing. The returned "form" is a data record 6 which is 

11 stored in a merchant transaction database 7 for retrieval and processing in due course to 

12 cause the ordered items to be gathered, packaged and prepared for shipment along with 

13 financial processing to debit fhe customer's credit account. The finandal processing may 

1 4 include a validity check of the credit account and an authorization check for the amount of 

1 5 purchase with the credit card issuer. Additionally, inventory management processes are 

1 6 executed based on the items withdrawn from stock for shipment. 

17 In a three party embodiment of the present invention, the process 1 makes use of 

18 an entity referred to herein as a machine data archiving service, MDAS or archive service, 

1 9 which operates an archive service computer system IS, including an archive service web 
2 0 idte 16. The archive service system IS maintains a machine data ardiive service database 
21 or archive 17 in which the machine data collection profiles 18 firom customs computers S 
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1 The customer computer 20 may have a fixed IP address, depending on ^e mann^ 

2 inwhichitisinter&ced.totheint^et. More conunonly, the customer computer 20 

3 have a temporary or dynamically assigned IP address wliich is determined by the primary 

4 router22. The primary router 22 has an IP address, as do a router ofa LAN 24 or an 

5 HTTP proxy 26 if dther is present in the customer's computer system 5. 

6 Fig. 3 illustrates the prindpal actions or steps of a general or basic process 34 of 

7 the process 1 for coUecdng machme identifying data from customer computers 5. At st^ 

8 35, at least one machine identifying profile parameter is captured upon access of a 

9 customer computer S or other online access device ^mth a host or merchant web sate 3. A 
1 0 unique transaction identifier or TA/ID is generated at 36 and associated at 37 with the 

.11 captured profile parameter. The transaction ID is also assodated at step 38 with a 

.12 transaction record generated as a result of the interaction or transaction conducted 

13 between the customer computer 5 and a merdiant web ^ 3. Althougjli not spedfically 

1 4 shown in Fig. 3, the process 34 may capture machine profile data tiiat is passed firom the 

1 5 customer computer 5 to the merchant computer 3 a& an inherent step of the customer 

1 6 computer S accessmg the merchant computer 3 . Alternatively, the process 34 may pass 

1 7 routines to the customer computer 5 to cause it to "self-identify^* itself by querying certain 

1 8 configuration parameters and passing such information to a machine profile stored dther 

1 9 withm the merchant's system 2 or in a thh-d party archive 17. The process 34, thus, 

2 0 encompasses a two-party embodiment or a three party embodiment of the machine data 

2 1 coUeotion and archiving process 1 of the present inventioiL 

15 
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1 merchant's transaction database 7. Thereaft^, qualified parties may access l^e MDAS 

2 ardiive 17 for information related to a transaction ID. 

3 The MDAS archive 17 need not contain any information vridch specifically 

4 idoDtifies a particular customer, only the maclune parameter profiles 18 tvith assodaited 

5 transaction ID strings. The MDAS ardiive records 18 cim be analyzed in coigunction with 

6 the merchant transaction records for patterns offimid or for other purposes. The great 

7 majoiily of MDAS archive records can be puiged fi<om the ardiive 17 after a selected 

8 period of time. Any records which are associated with any transaction irregularities or • 

9 suspidonsofactualfiraud may be retaiined longer. 

1 0 Hg. 5 illustrates the prindpal steps of a preferred embodiment 60 of the madune 

1 1 data collection and archiving process 1 of the present invention. The process 60 begins 

1 2 with the addition at 62 of a madiine data collection (NdDC) script to the transaction (TA). 

1 3 form page code of a merchant web rite 3. The transaction form page code is processed at 

14 64 by a customer browser 28 yUatn the iftoxshant web page is accessed to there^ reqo^ 

15 the MDC script at 66 fi-om the Machine data arduve service (MDAS) web site 16. When 

16 the browser 28 accesses the MDAS wd> site 16, requestiAg tiie MDC script, the MDAS 

1 7 web ate checks for tiie presence of an MDAS cookie at step 68. If no MDAS cookie is 

1 8 detected, an MDAS cookie is goierated at 70 and a umque^ansaction identification 

19 (TA/ID) string is generated at 72. The MDC script, transaction ID, and cookie, if not 
2 0 previous^ set, are returned at 74 to the customer browser 28, the transaction ID beiqg 
21 embedded within the MDC script 

17 
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1 MDAS web site 16 along with an HTTP header with cookie and "apparent" IP address, all 

2 ofwMch are stored as 9 machine data profile 1.8 within the MDAS arcMvel^^ 

3 At step 90, the MDC script adds a proxy piercer request to the transaction form 

4 which, wh^ executed by the browser 28 at step 92, sends a request for a proxy piercer 

5 applet or code to the MDAS web site 16. When the pro)^ piercer applet/code is executed 

6 by the browser 28 at 94, a tune ^ue from the clock 32 is again queried at 96 and any 

7 ^sting local area network (LAN) address is queried at 98« At step 100, the proxy piercer 

8 applet/code sends the time value, the L At^ address (if any), and the transaction ID to the 

9 MDAS web site 16 by a protocol which bypasses any existing HltiV proxy 26: The 

1 0 protocol used is one which is at a lower level than HTTP, such as UDP (us^ datagram 

1 1 protocol) or, preferabfy, TCP/IP (transmission control protocol^temet protocol). 

1 2 Bypassing the HTTP proxy 26 causes the data sent in step 100 to arrive at the 

13 MDAS web site 16 with the IP address of the primaiy gateway 22, whichmay be different 

14 fi-omany^parentlPaddresspreviouslyrecordedifanHTTPpro Ifthe 

1 5 proxy piercer procedure 82 is success&l, the primaiy gateway IP address is stored at step 

16 102 within the machine data profile 18 identified by the transaction ID. It should be noted 

17 that some types of proxies, such as some ^es of firewalls, may block all non-HTTP 

1 8 protocol packets, so that the proxy piercer procedure 82 nngiht not be successfiil in all 

19 cases. 
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1 and the madiine parameter set. An exemplary transaction ID is a string of24 letters and 

2 digits. The £b-st eight digits form a time-stanq>.\vUc^ is a hexadedncolre^ 

3 the seconds elapsed since midnight January 1, 1970 UTG (coordinated univosal time). 

4 Li the preferred embodiment of the process 1, the MDC script is written in an 

5 ECMASo^t cofflpfiant language, sudi as JavaSaipt,JScnpt, or VBSa^^ AJavaScr^ 

6 version of the MDC saipt is as follows (linebreaks and mdentations added for clarity): 
7 

8 document. write("<input name=transactiomd type^hidden value=ZZZ>; 

9 

10 d=newDateO; 

11 

12 t?=3600*d.gefHoufsO+60*d.gefNfinutesO+d.getSecondsO; 
13 

14 docum«atwrite("<mghdg|it=l widthFl snHitQ)s://www.exampte- 

15 url.net/t/?i=ZZZ&t=W>"); 
16 

17 document.write("<applethd^it=l width=l 

18 codebase=https://www.example-url.net/ 

19 code=a/?ZZZ> 

2 0 <iparam nameNL value=ZZZX/applet>"); 

21 
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1 c) it sends this data back to the archive service 16 via TCP/IP, by requesting 

2 the following URL: 

3 http:/Avww.example-urLnet/d/?i«ZZZ&t=<m 

4 The archive service 16 receives the message which includes the parameters TTT, 

5 AAA, and ZZZ. The message also indudes the IP address of the sender. This address is 

6 the customer's actual IP address, which in some cases is different from the HTTP proxy IP 

7 address. The archive service 16 records this information in the MDAS archive 17 and 

8 associates it with the transaction ID ZZZ. 

9 The machine data collection and archiving process 1 of the present invention has 

1 0 been described with a particular application in fraud detection. However, it is foreseen 

1 1 that the techniques of the present invention have a wider application, as for marketing or 

1 2 computer support purposes, or other functions. While the process 1 has hem described 

1 3 with reference to the internet 4 or world wide web, it is also conceivable that the process 1 

1 4 could be employed on computer networks of less than gjlobal expanse, such as a large 

1 5 intranet, a national or regional networl^ or the like. 

1 6 Therefore, it is to be understood that while certain forms of the present invention 

1 7 have been illustrated and descdbed herein, the present invention is not intended to be 

1 8 limited to the specific forms, arrangement of parts, sequence of steps, or particular 

1 9 applications desoribed and ^own. 
20 
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4. A process as set forth in Claim 1 and including the steps of: 

(a) commuoicating a self-identification routine to said access device upon said 
access device accessing said host computer system; 

(b) said access device executing said self-identification routine; 

(c) said self-identification routine.queiying a configuration setting of said 
access device to. derive said profile parametei^ and 

(d) smd self-identification routine communicating said profile parameter to a 
remote location for assodation with said interaction identification string. 

5. A process as set forth in Claim 1 and including the steps of. 

(a) said host system operating a host web ^te including an interaction page 
graerated by interaction page code processed by said access device upon 
accessing said host web site; and 

(b) coding, withm said interaction page code, a sdf-identffication routine 
which causes said access device to communicate said profile parameter 
when said access device processes said interaction page code. 

6. Aprocess as set forth in Claim 3 and including the kep of: 

(a) codmg said self-identification routine in such a manner that said profile 
parameter and said interaction identification string are communicated to a 



25 



wo 01/97134 

PCT/USOl/18076 



Ktentifiqstion stiMig are stored. . 



7. ^P-^forideotifying^customercomputeriavolvedin 
between a customer using a customer bro^- 



9n C#UU1JC irHTTQO/t+ilQQ 



operating on said customer 
the steps of ^ 
(a) ^'apturiqgacustomercomputerpnjffle 



computer accessiag said merchant web sfte; 

(^) ^--^^^onidentificationstH^and.^ 
with said paranetei; 

™«y associate sMd patameterwitli 
"id ttamactto, TBcori tliraigh „id ad^ 
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9. A process as set forth in Claim 7 wherdn said Cf^turing step includes the step o£: 
(a) capturing a configuration setting of said customo" computer. 

10. A process as set forth in Claim 7 and including the step of: 

(a) communicating said profile parameter and said transaction identification 
String ta a third party web site for Storage. 

11. A process as set forth in Claim 7 and including the step of. 

(a) causing said customer computer to communicate said profile parameter and 
said transaction identification string to a third party web site for storage. 

12. A process as set forth in Claim 7 and including the steps of: 

(a) communicating a self-identification routine to said customer computer 
upon said customer computer accessing said merchant web site; 

(b) . said customer computer executing said self-idratification routine; 

(c) said self-identification routine queiying a configuration setting of said 
customer computer to derive sdd profile parameter; and 

(d) said self-identification routine commimicatirig said profile parameter to a 
remote location for association with said interaction identification string. 
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are Stored, 



(.) '^'^^^^,^^„„^^ 

(c; P'O'^ssing said attn^utestrinc to form .-.-^ « 

sning to fonn said profile parameter of said 

customs computer. 



aa»sses said merchant web Site bvwav of a ^ , 

ieDyTvayofap««y,andsaidcoiimnmicatingstep 
Mdudes the steps ofi 



«>roiigh a merchant web Site between , 
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operating on said customer computer and a merchant who operates said web site, 
said method comprising the steps of 

(a) coding a script request within a transaction form of said merchant web site; 

(b) processing said script request by said customer browser upon accessing 
said merchant web site to thereby commimicate to an archiver web site of a 
machine data archiving sendee an dectronic request for a machine data 
collection script; 

(c) said archiver web ^e retummg said script to said customer browser along 
with a unique transaction identification string; 

(d) said customer browser processing said soript to thereby cause said script to 
queiy said customer computer for a profile parameter of said customer 
computer; 

(e) said script causing said customer browser to communicate said profile 
parameter and said transaction idmtification string to said ardiiver web 
site; 

(f) said archiver web site storing said profile parameter and said transaction 
identification string in a machine data profile; 

(g) said script causing said customer browser tb write said transaction 
identification string into said transaction form; and 

Oi) upon said customer adding customer identification infomiation to said 

transaction form and electronically submitting said transaction form to said 
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(b) ««darcIuverserviceadditioflallv«.n- 



(a) said script queiyipg said 



le step of 

a configuration setta^g 
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(c) said script processing md attribute string to fonn said profile paramef ^ of 
said customer computer/ 

20. A process as set forth in Claim 19 wherdn said soipt processing step includes the 
step of: 

(a) said script performing a hashing function on said attribute string to form 
said profile paramet^. 

21. A process as set forth in Claim 16 wherein said customer compute potentially 
accesses said merchant web site by way of a proxy, and including the step o£ 
(a) said script communicating said profile parameter and said transaction 

identification string to said archiver service web dte using a.protocol which 
bypasses said proxy. 

22. A process as set forth in Claim 16 and including the step of: 

(a) said script communicating said profile parameter to said archiver service 
web site using a protocol other than HTTP. 

23. A process as set forth in Claun 16 wherem said customer computer includes a 
digital clock, and including the steps of: 



31 



wo 01/97134 



PCT/USOl/18076 



value; and ™^ 

^'^"^a tune value to said 

a«*iver sendee web ate aloug^^. 



A process for 
. ""'"^^"^^^-^^tebetwee^acustomer 



identifying a customer compute imrolved in 

using a customer browser 



operate, sad webdte. 



»P«^<>" Mid oustomer compter 
W «'*«««Hp,«^™.^.,,^^ 

machme data archiviiig service an -i-^*^ . 

^semceandectromc^questforamachined^ 

collection script; 

(0) saidarchiverw^sitemunaqgsaidscrinttn. 

^***'^'*^«o«»«-browseralong 

^auniquetransactionidentificationstring. 

(0 ^eiy said customer browserfor««i 

nrowserforaplurahfy of configuration 

settings; 
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(3) perfonn a hashing &nction on said attribute string to fonn said 
profile parameter; and . 

(4) query an internal digital clock of said customer computer for a 
current time value; 

(e) said script rausing said customer browser to communicate said profile 

parameter, said time value, and said transaction identification string to said 
archiver web site along with a conventional HTTP header, 

(0 said archiver wd) site storing said profile parameter, said time value, and 
said transaction identification string in a machine data profile; 

(g) said script causing said customer browser to write said transaction 
identification string into said transaction form; and 

(h) upon said customer adding customer identification information to said 
transaction form and electronically submitting said transaction form to said 
merchant web inte to tiiereby comprise a transaction record, said 
transaction identification string associating said transaction record with said 
machine data profile. 

25. A process as set forth in Claim 24 wherein said customer computer potentially 
accesses said merchant web site by way of a proxy, and including the steps o£ 
(a) said script querying said customer computer for a second profile parameter; 
and 
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protocol whicfcbypasses said projgr. 



A process as set forth in Claim 2^ w . 
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